topic Re: google not working with chrome update if unknown-udp is blocked in General Topics

google not working with chrome update if unknown-udp is blocked

PanIst — Tue, 18 Oct 2016 14:35:19 GMT

Hi,

chrome version 54.0.2840.59m if unknown-udp is blocked - google is not working

Any idea ?

Thanks

Re: google not working with chrome update if unknown-udp is blocked

BPry — Tue, 18 Oct 2016 15:53:43 GMT

@PanIst I can't reproduce the issue on my 3020. Did you recently install a new applications and threats update? I'm still on 621 until this evening and everything is working perfectly on 54.0.2840.59 m.

Re: google not working with chrome update if unknown-udp is blocked

PanIst — Tue, 18 Oct 2016 16:00:45 GMT

Hi,

please use a deny rule for unknown-udp at top and app-id is 623

Tried with 3 paloalto(vm,5050 and pa200) same issue

Regards

Re: google not working with chrome update if unknown-udp is blocked

PanIst — Tue, 18 Oct 2016 16:43:19 GMT

app-id version is not ipmportant.Tried with 614 and it is same.

Re: google not working with chrome update if unknown-udp is blocked

BPry — Tue, 18 Oct 2016 16:48:27 GMT

@PanIst I'm not seeing the same issue; traffic is being identified correctly and nothing is getting denied because of the Chrome update.

Re: google not working with chrome update if unknown-udp is blocked

PanIst — Tue, 18 Oct 2016 16:53:03 GMT

I'm sorry but there must be something different at your side.We replicated it on 3 different customer.Thanks

Re: google not working with chrome update if unknown-udp is blocked

PanIst — Tue, 18 Oct 2016 17:03:39 GMT

Re: google not working with chrome update if unknown-udp is blocked

Raido_Rattameister — Tue, 18 Oct 2016 17:17:18 GMT

Chrome uses quic by default that runs over udp.

Probably they changed the behaviour and Palo AppID does not match any more.

Temporary workaround might be to disable quic in Chrome.

You can't decypt quic anyway so you loose visibility when users access Google services with Chrome so disabling it might be good idea anyway.

https://www.google.ee/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=chrome%20disable%20quic

Re: google not working with chrome update if unknown-udp is blocked

RichColeman — Thu, 20 Oct 2016 08:48:52 GMT

Had the same issue, Palo TAC advises that the content team is working to resolve the issue. Watch this space for an emergency release.

Re: google not working with chrome update if unknown-udp is blocked

luancb — Fri, 21 Oct 2016 09:52:12 GMT

Version 625
Notes:
With the most recent version of the browser Chrome, Google updated their experimental protocol QUIC, which caused the "quic" App-ID to be misidentified as "unknown-udp". With this content update, Palo Alto Networks is releasing additional coverage for the "quic" App-ID to include the changes made by Google.